Deepfakes created from Facebook tagged photographs on Bluesky

The combined situation

Photographs of you from Facebook, including tagged photos posted by other users, have been used as input to AI deepfake tools. The Facebook tagging system creates a wide attack surface that no individual user can fully restrict. When this scenario plays out on Bluesky specifically, removal proceeds through the statutory takedown process under 47 USC 223a combined with the scenario specific response that source cases require.

Why this combination is high risk

Bluesky's open ATProto network allows third party clients and appViews to display the same content. A removal from the official Bluesky app does not always remove from third party clients. For facebook source deepfake cases, facebook tagged photographs are accessible to a much wider audience than individual privacy settings suggest because the tagging system is governed by the original poster's settings.

How removal proceeds

Bluesky accepts NCII reports through its in app moderation flow and through its trust and safety email. The PDS architecture means content is hosted on individual personal data servers in addition to the network appView. Facebook tag history is preserved in Meta records and is recoverable through subpoena even after untagging, which preserves the source connection evidence.